Hackers are backdooring QNAP NAS devices with 3-year old RCE bug

mood · Sep 1, 2020

Hackers are backdooring QNAP NAS devices with 3-year old RCE bug
August 31, 2020
https://www.bleepingcomputer.com/ne...ing-qnap-nas-devices-with-3-year-old-rce-bug/

Hackers are scanning for vulnerable network-attached storage (NAS) devices running multiple QNAP firmware versions, trying to exploit a remote code execution (RCE) vulnerability addressed by QNAP in a previous release.

According to a report published today by researchers at Qihoo 360's Network Security Research Lab (360 Netlab), unknown threat actors are currently exploiting a remote command execution vulnerability due to a command injection weakness in QNAP NAS devices' firmware.
Command injection vulnerability leading to RCE
The vulnerability allows unauthenticated, remote attackers to achieve authentication using the authLogout.cgi executable because it fails to sanitize input —doesn't filter out special characters — and calls the system function to run the command string, allowing for command injection which allows for remote code execution.
Click to expand...

QNAP fixed the vulnerability in firmware version 4.3.3 — released on July 21, 2017 — by replacing the function used to run the command strings.

"On August 12, 2020, QNAP PSIRT replied that the vulnerability had been fixed in early updates, but such attacks still exist in the network."
QNAP customers urged to upgrade
360 Netlab provides a list of all affected QNAP firmware versions and indicators of compromise including the attackers' scanner and downloader IP addresses.
Click to expand...

Qihoo 360 Netlab: In the wild QNAP NAS attacks

From April 21, 2020, 360Netlab Anglerfish honeypot started to see a new QNAP NAS vulnerability being used to launch attack against QNAP NAS equipment. We noticed that this vulnerability has not been announced on the Internet, and the attacker is cautious in the process of exploiting it.
Click to expand...

Log in or Sign up

Hackers are backdooring QNAP NAS devices with 3-year old RCE bug

mood Updates Team

Log in or Sign up

Hackers are backdooring QNAP NAS devices with 3-year old RCE bug

mood Updates Team

Useful Searches